Re: Privileged File Access from Desktop Applications

[John Haxby <john.haxby () oracle com>]

> On 11 Jul 2019, at 16:57, Bob Friesenhahn <bfriesen () simple dallas tx us> wrote:
>
> On Thu, 11 Jul 2019, Perry E. Metzger wrote:
> > It seems like a bad idea.
> >
> > If one wants to have mechanisms by which the operating system can
> > allow unprivileged programs to temporarily assume privileges (which
> > is a frequent idea in security), then they should be carefully
> > designed and part of the OS, rather than creating an ad hoc facility
> > via a subsystem that isn't intended for it. There are good ways to do
> > that, like capabilities.
>
> I agree.  It is rather common that more than one file needs to be modified at one time.  If a more complex mechanism 
> like a sqlite3 database needs to be updated, then the implementation of sqlite3 will expect to be able to access 
> files in a normal way and it will expect to be use all the abilities it normally uses.  It is rather common that 
> atomic operations are required, locking is required, the ability to link/rename files is required, and that 
> synchronization of file content and directories is required.
>
> In addition to the security concerns, it is difficult to see how a virtual filesystem intended for use by simplistic 
> GUI file managers will satisfy common administrative requirements.

This bit us recently with a graphical application that needed to run as root (I forget what for).   It also struck me 
that I often run gparted (don't ask why :)) which needs to dink with disks.

Obviously one could split the process into its graphical half and its messing-around-with-disks half but it's not clear 
to me how the graphical half would handle authentication[*] for the process that needs to run as root.   There are any 
number of administrative tasks that will need to be redesigned to cope with this change.

jch


[*] Yes, you could, for example, use $SUDO_USER/UID/etc but you can bet that that will throw up all kinds of security 
problems that we don't have today.

Attachment: signature.asc
Description: Message signed with OpenPGP